Time based Injection? - Printable Version

Time based Injection? - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: Time based Injection? (/showthread.php?tid=3929724)

Time based Injection? - pwntoken - Dec 15, 2013

Is this really happening or just a false alarm?

Code 
http://internationalhotels.yatra.com/hotel/search/search?currencyCode=INR&additionalDataString=vrBookingSource|null&locale=en_IN&cid=317676&1%2527=1

There is this time delay burp took up. If this could be down I really would need a conformation on this? thanks mates.

EDIT: also here.

Code 
http://railtourpackages.yatra.com/trainpackages/home

I submit the USER-AGENT as:

Code 
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)'%20and%201%20in%20(select%20benchmark(200%2csha1(1)))--%20

Burp says it's time based? 🤦‍♂

also here

Code 
http://js1.yatra.com/web/guest?1%2bbenchmark(200%2csha1(1))--%20=1

* - Mx. - Dec 15, 2013

It's a false alarm generated by the delay in burp.

* - pwntoken - Dec 16, 2013

(Dec 15, 2013 05:38 PM)Mx. Wrote: It's a false alarm generated by the delay in burp.

damn this means the delay in burp and the timeout's produce a MySQL time based Injection possibility? and how come the developers didn't fixed this yet? 🤨

* - Zixem - Dec 16, 2013

Like Mx. said, it's a false alarm. Don't trust burp when it comes to Time-Based injection. Always double check with Tamper Data to make sure it's really vulnerable.
Here's my result when I tried make a delay of five seconds with time():

User agent injection:

Code 
23:07:59.175[544ms][total 2592ms] Status: 200[OK]

Third link:

Code 
23:01:14.036[1137ms][total 1137ms] Status: 302[Moved Temporarily]

see? it barely gets to 4000ms of response time...no chance to time based here.
about the first link...the server return 404 response...is this supposed to be like that?

* - pwntoken - Dec 16, 2013

(Dec 16, 2013 02:10 PM)Zixem Wrote: Like Mx. said, it's a false alarm. Don't trust burp when it comes to Time-Based injection. Always double check with Tamper Data to make sure it's really vulnerable.
Here's my result when I tried make a delay of five seconds with time():

User agent injection:

Code
23:07:59.175[544ms][total 2592ms] Status: 200[OK]
Third link:

Code
23:01:14.036[1137ms][total 1137ms] Status: 302[Moved Temporarily]
see? it barely gets to 4000ms of response time...no chance to time based here.
about the first link...the server return 404 response...is this supposed to be like that?

gave me 200 Status code, I have no clue how it gives 404 for you.

* - hellozepyr123 - Dec 17, 2013

Encrypted is right i dont see anything wrong with the code itslef

* - pwntoken - Dec 17, 2013

(Dec 17, 2013 10:15 AM)hellozepyr123 Wrote: Encrypted is right i dont see anything wrong with the code itslef

No, it's false alarm IMO. The buro delay does it. I wouldn't had posted this if I was sure it was a real pick :P I was sure about 80% that this was burp doing it. So I rechecked.